Accessibility

Theme
Text size
Text spacing
Font
Contrast
Links
Motion
Accessibility statement

Guides · Method

How to Trace Stolen Cryptocurrency

To trace stolen cryptocurrency, start from the records of the transfer: the transaction hash, the addresses, the date, and the network. Those records are compared with the public ledger, and later transfers are followed where the data still supports a link. Swaps and bridges can continue the path onto another asset or another chain. Some trails reach a known service. Others end in an unresolved hop. BNG SOFTWARE does this review without asking for a seed phrase or a private key.

Close view of a dark monitor with an abstract chain of linked transfers and no readable hash.

What can you gather safely before anyone is instructed?

These steps preserve your own records. They are not an investigation into anyone else, and none of them involves giving up control of a wallet.

  1. Copy the transaction hash as text, and note the network it belongs to.
  2. Record the sending and receiving addresses and the approximate time.
  3. Save account pages, receipts, and the conversation that led to the payment, including the page address if it was a website.
  4. Keep the originals. Do not crop screenshots until they lose their context.
  5. Do not give a seed phrase, private key, password, or remote-control access to a person offering to trace the funds.

Two longer references: What a Transaction Hash Can and Cannot Tell You and What Evidence Should You Preserve After a Crypto Scam?

Regulatory Notice Due to international regulatory requirements, BNG Software does not accept clients who are citizens or permanent residents of the United States, Germany, Italy, or France.

Do not send a seed phrase, a private key, or a password.

If you want those records reviewed, request a confidential case assessment.

Request a Confidential Case Assessment

What a trace is actually following

A trace follows recorded value, not a person's name. On a public network the transfer shows addresses, an asset, an amount, a fee, and a time. On a smart-contract network it may also show a contract call and events. The next question is where that destination address sent value afterwards, and whether that next transfer is the same economic path or only a neighbour on the graph. Inside BNG SOFTWARE, addresses and transfers are modelled in BNG Atlas, a temporal graph of activity, and every result stays linked to its source transactions for analyst review.

What the findings should separate

  • Verified: an on-chain event, confirmed on the ledger itself.
  • Protocol: a relationship the protocol's own records support, such as a recognised swap or a bridge deposit and release.
  • Probable: a relationship that still needs review, such as a candidate transfer matched by amount and timing.
  • Unresolved: a destination the current data does not settle.

A report that treats every probable link as a fact is weaker than one that names its uncertainty.

Where this overview stops

Is the material you gathered enough to follow?

A short review can answer that before a larger investigation is proposed. If the trail is already ambiguous, the useful result is to hear it early. That question is the subject of Can Stolen Cryptocurrency Be Recovered?

For companies and funds

A company trace starts from the same objects: which wallet signed, which contract emitted an event, which bridge was used. The set is usually larger, and the report needs a method section the company's counsel can read. The document is described in What Is a Blockchain Forensic Investigation Report?

A note for lawyers

Counsel often needs the hash treated as a starting point rather than as proof of who controls the destination. The limits of attribution are covered in Can You Identify the Owner of a Crypto Wallet? The technical work can be instructed by the client or by the firm, as the engagement states.

What the next paid step is, if you want one

The order of an engagement is set out in How Does Cryptocurrency Recovery Work? The assessment below is the place to share hashes and addresses. Passwords, seed phrases, and private keys do not belong in it.

Frequently asked questions

Can I trace it myself on a block explorer?

You can usually see the single transfer a hash points to. A block explorer does not, by itself, decide which later hops are the same funds, or whether a destination is a known service. That is the review.

Does the method change for Bitcoin and for USDT?

The records you preserve are the same kind of records. USDT exists on more than one network, so the network name matters. The limit is also the same: the ledger shows transfers, not a legal judgment about recovery.

Will you connect to my wallet?

No. Ordinary tracing does not need wallet access, a seed phrase, or remote-access software.

Can the trace name the owner?

Not as a standard result. An address is pseudonymous, and a legal name usually has to come from records held off-chain.

Is a trace the same as recovery?

No. A trace is the map. Recovery, if it happens, is a later outcome that depends on other parties.

Further reading

Confidential Case Intake

Request a confidential case assessment

Share a short description of what happened and any public transaction references you have. Please do not submit passwords, seed phrases, private keys or unnecessary identity documents through this form.

Regulatory Notice Due to international regulatory requirements, BNG Software does not accept clients who are citizens or permanent residents of the United States, Germany, Italy, or France.

Name, email, phone, country, and the message are required. By submitting this form you confirm that you have read the Privacy Policy. A signed engagement agreement governs any later work. Never include seed phrases, private keys or passwords in your message.

Declarations

If the inquiry is received, the company provides a reference number for later correspondence. That number is not a court number and it is not a police number.